How to apply the Magento 2 patches?

Traditional

You can use the traditional method:

git apply MAGEPatch-20181106.patch

or

patch -p1 < MDVA-14172_EE_2.2.6_COMPOSER_v1.patch    

Composer

Or to solve the same situation with files being patched in the vendor directory, there is a good article on it here: http://jamescowie.me/blog/2016/12/Composer-Magento-Patches/

We did something similar in our composer file:

...
   "extra": {
        "magento-force": "override",
        "composer-exit-on-patch-failure": true,
        "patches": {
            "magento/module-cache-invalidate": {
                "GH 8815: Varnish purge requests can overrun size limit": "patches/composer/github-issue-8815.patch"
            },
        }
    }
...

In our Magento root, we have a patches/composer directory which is where we reference them and in the extras/patches section, we tell it which Magento module to patch.

Ironically I found this post when looking at how this was done only to find our solution was already in place by our initial vendor.

If you have git installed on your environment just use the following copy the patch on you magento root folder.

Then use:

$ git apply MAGETWO-67805-2017-05-17-03-04-03.patch

If anyone is doing this via Composer there is a free module you can install it allows you to install patches from the cli.

magento@ce87c6cc1cdf /home/magento/htdocs/$ php bin/magento patch:list
Magento Version: 2.3.0
PRODSECBUG-2198 - This patch provides protection against the SQL injection vulnerability described under PRODSECBUG-2198
More info can be found here: https://www.magentocommerce.com/products/downloads/magento/#download2288

magento@ce87c6cc1cdf /home/magento/htdocs/$ php bin/magento patch:add --patch=PRODSECBUG-2198
Patch: PRODSECBUG-2198
Message: PRODSECBUG-2198 - Added via Zero1_Patches
Magento Version: 2.3.0
SUCCESS!
The patch has been added to you composer.json
You can now run: "composer install" to apply the patch.
magento@ce87c6cc1cdf /home/magento/htdocs/$

I use it on Mdoq, but it can be used anywhere.
There is a good blog post on it here